<?xml version="1.0"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
	"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
	<head>
		<title>OpenVPN Auth-LDAP Plugin</title>
		<meta http-equiv="Content-type" content="text/html;
		charset=iso-8859-1"/>
		<link rel="stylesheet" type="text/css" href="default.css"/>
	</head>
	<body>
		<h1>Three Rings' OpenVPN Auth-LDAP Plugin <img style="float: right;" src="dpw.png" alt="DPW Logo"/></h1>
		<ul id="nav">
			<li><a href="#intro">Introduction</a></li>
			<li><a href="#get">Download</a></li>
			<li><a href="#build">Building</a></li>
			<li><a href="#usage">Usage</a></li>
			<li><a href="#cav">Caveats</a></li>
			<li><a href="#security">Security</a></li>
		</ul>

		<h2><a id="intro">Introduction</a></h2>
		<p>
			The OpenVPN Auth-LDAP Plugin implements username/password authentication
			via LDAP for OpenVPN 2.x. It also includes some integration
			with the OpenBSD packet filter, supporting adding and removing VPN clients
			from PF tables.
		</p>

		<p>
		You may send patches, bug reports, and complaints to the <a href="https://dpw.threerings.net/mailman/listinfo/openvpn-auth-ldap">mailing list</a>.
		</p>

		<h2><a id="get">Download</a></h2>
		<p>
			The source for auth-ldap 2.0.3 can be downloaded <a
				href="auth-ldap-2.0.3.tar.gz">here</a>, and verified against this <a
				href="auth-ldap-2.0.3.tar.gz.sig">GPG signature.</a> The 
			signature was made with key 0x85971303, which you can find <a
                href="http://dpw.threerings.net/dpw_public_key.asc">here</a> or 
            retrieve from a subkeys.pgp.net keyserver.
        </p>
    	<h4>Changes since 2.0.2</h4>
		<ul>
			<li>Improved reporting of LDAP errors (Added support for the server-supplied LDAP_OPT_ERROR_STRING).</li>
		</ul>
        
		<h4>Changes since 2.0.1</h4>
		<ul>
			<li>Added the FollowReferrals configuration option, for enabling/disabling following of LDAP referrals.</li>
		</ul>


		<h4>Changes since 2.0</h4>
		<ul>
			<li>(Security) Fixed a bug in bind handling, where OpenVPN Auth-LDAP would accept empty passwords when validating against Novell Directory Server. This is known to not affect default installs of OpenLDAP (our test platform). <a href="#security">More info</a></li>
		</ul>

		<h2><a id="build">Building</a></h2>
		<h4>Requirements:</h4>
		<ul>
			<li>OpenLDAP Headers and Library</li>
			<li>GNU Objective-C Compiler</li>
			<li>OpenVPN Plugin Header (included with the OpenVPN sources)</li>
			<li><a href="http://www.re2c.org">re2c</a></li>
		</ul>
		<p>
			To build, you will need to configure the sources
			appropriately. Example:
		</p>
		<pre>./configure --prefix=/usr/local --with-openldap=/usr/local --with-openvpn=/usr/ports/security/openvpn/work/openvpn-2.0.2</pre>

		<p>
			The module will be build in src/openvpn-auth-ldap.so
			and installed as ${prefix}/lib/openvpn-auth-ldap.so.
		</p>

		<h2><a id="usage">Usage</a></h2>
		<p>
			Add the following to your OpenVPN configuration file (adjusting the plugin path as required):
		</p>

		<pre>plugin /usr/local/lib/openvpn-auth-ldap.so "&lt;config&gt;"</pre>

		<p>
			The config directive must point to an auth-ldap configuration file.
			An example configuration file is provided with the distribution.
		</p>

		<h2><a id="cav">Caveats</a></h2>
		<ul>
			<li>This plugin requires the OpenLDAP libraries to build. The plugin will, however, authenticate against any LDAP server that supports LDAP simple binds -- including Active Directory.</li>
		</ul>
		<h2><a id="security">Security</a></h2>
		<h4>Please report all security issues to dpw@threerings.net.</h4>
		<p>Through the use of extensive unit testing, valgrind, and regression testing, we are very confident in the overall code quality of the plugin. There has been one security vulnerability to date, due to misinterpretation of LDAP RFCs.</p>
		<ul>
			<li>2006-12-02: OpenVPN Auth-LDAP would accept empty passwords when validating against Novell Directory Server. This is known to not affect default installs of OpenLDAP (our test platform). Strict implementation of the LDAP RFCs requires that a directory server treat a bind with a valid DN and an empty password as an "anonymous" bind. If anonymous binds are enabled, this could lead to password bypass.</li>
		</ul>
	</body>
</html>	
